Use the timeline to investigate patterns of events

The timeline is a visual representation of the number of events that occur at each point in time. It shows the distribution of events over time. Mouseover a bar to see the count of events. Click on a bar to drill-down to that time. Drilling down in this way does not run a new search, it just filters the results from the previous search. You can use the timeline to highlight patterns or clusters of events or investigate peaks (spikes in activity) and lows (possible server downtime) in event activity.

The timeline options are located above the timeline. You can zoom in and zoom out and change the scale of the chart. Collapsing the time line is handy if you want more room for events and are not concerned with the time line. Click to restore it when you are.

Change the scale of the timeline

You can view the timeline on two scales: linear or logarithmic (log).

The following image shows the search results for all events in the second quarter on a linear scale.

The following image shows the same search results for all events in the second quarter on a log scale.

Zoom in and zoom out to investigate events

Zoom in and out changes the time focus; for example, zooming in will change timeline bars from hours to minutes. Clicking the bar drills down to events that minute. Zooming out pulls up a level to see events over hours or days instead of minutes.

Click and drag your mouse over a cluster of bars in the timeline.

Your search results update to display only the events that occurred in that selected time range.

If you click zoom in, the timeline updates to display only the span of events that you selected.

Click on one bar in the timeline.

Your search results update to display only the events that occur at that selected point.

Once again, if you click zoom in, the timeline updates to display only the events in that selected point.

If you want to select all the the bars in the timeline (undo your previous selection) click select all. This option is only available after you've selected one or more bars and before you selected either zoom in or zoom out.

Comments

@Dzaner, I don't think they have this option. I would love to know if it did exist though.

AccentureQBETA

August 28, 2012

Is there an easy way to shift the timeline? In the examples on this page, the major units are months, so one would expect a way to tell the timeline "move forward one month" or "move backwards one month". Again, using the examples on this page, you might notice a trend and want to see if it continues in July 2009. How can you easily display May 2009, June 2009 and July 2009 without typing dates in search parameters?

Enter your email address, and someone from the documentation team will respond to you:

Send me a copy of this feedback

Please provide your comments here. Ask a question or make a suggestion.

Feedback submitted, thanks!

You must be logged into splunk.com in order to post comments.
Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic.
If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk,
consider posting a question to Splunkbase Answers.

0
out of 1000 Characters

Your Comment Has Been Posted Above

We use our own and third-party cookies to provide you with a great online experience. We also use these cookies to improve our products and services, support our marketing campaigns, and advertise to you on our website and other websites. Some cookies may continue to collect information after you have left our website.
Learn more (including how to update your settings) here »